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Dated: 27 May 2021 

Subject: Updates to maximum storage duration disclosure requirements 

Dear TCF Vendors and CMPs, 

The TCF Steering Group has approved TCF policy amendments, related to the maximum 
storage duration disclosure requirements. The amendments have been reflected in an 


update to the TCF Technical Specifications. 


Implementation deadlines are detailed below. Please consult the latest versions of the TCF 
Policy and Technical Specifications for the complete requirements. 


Amendment to TCF Policy 16(2bis) 
TCF Policy 16(2bis) requires Vendors to disclose their storage duration practices. The 
following amendments have been adopted: 


1. The prohibition for Vendors to refresh their maximum storage duration unless the 
Framework signals indicate that the user has renewed their consent has been 
removed; 

2. A requirement for Vendors to indicate whether maximum storage duration may be 
refreshed has been added. 


Amendment to TCF Appendix B, Policy C(c) 
Appendix B relates to UI requirements. The following amendments have been adopted: 


1. The duration disclosure requirements in Appendix B, Policy C(c)(i) have been 
reformulated and transferred to a new policy in Appendix B, Policy C(c)(vii); 

2. A requirement to disclose refreshing practices by Vendors has been added in 
Appendix B, Policy C(c)(vii); 

3. An exemption from the requirements to disclose maximum cookie storage durations 
has been added to Appendix B, Policy C(c)(vii) for mobile/app environments. 


Updates to TCF GVL Registration and Technical Specifications 

The GVL registration page and TCF Technical Specifications have been updated with a 
true/false field enabling Vendors to indicate whether any cookies in scope for 
cookieMaxAgeSeconds are refreshed after being initially set. Please see the relevant technical 
documentation here, including an example of a refreshing practice. 


Logic underpinning the amendments 

Currently, the TCF Policies do not define circumstances or a timeframe within which CMPs 
are required to request users to renew their consent. Policy 5(1) TCF merely requires CMPs to 
remind users of their ability to withdraw consent at least every 13 months. This is mainly due 
to the fact that different requirements may apply in different jurisdictions regarding the 
appropriate amount of time for which consent can be stored. 
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Maintaining a prohibition for Vendors to refresh storage duration may thus result in Vendors 
never being allowed to refresh their storage duration once the initial indicated duration 
expires. It is considered that this goes beyond the scope of requirements that can be defined 
in the TCF and should be left up to each participant. For the avoidance of doubt: nothing 
prevents a Vendor to only refresh their maximum storage duration when a user has renewed 
consent. 


Implementation and enforcement 
The TCF CMP Validator will be updated to reflect these amendments but CMPs will not need 


to apply for re-validation of their Framework UI. 
The implementation deadlines are the following: 


e COB 23rd July 2021 - allowing Vendors 8 weeks to update their registration following 
the registration page update Friday 28th May; 
e COB 20th August 2021 - allowing CMPs 12 weeks to make the necessary disclosures; 
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